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Abstract. Since quantum information is continuous, its handling is sometimes surprisingly harder 
than the classical counterpart. A typical example is cloning; making a copy of digital information is 
straightforward but it is not possible exactly for quantum information. The question in this paper 
is whether or not quantum network coding is possible. Its classical counterpart is another good 
example to show that digital information flow can be done much more efficiently than conventional 
(say, liquid) flow. 

Our answer to the question is similar to the case of cloning, namely, it is shown that quantum 
network coding is possible if approximation is allowed, by using a simple network model called 
Butterfly. In this network, there are two flow paths, si to ti and S2 to t2, which shares a single 
bottleneck channel of capacity one. In the classical case, we can send two bits simultaneously, one 
for each path, in spite of the bottleneck. Our results for quantum network coding include: (i) We 
can send any quantum state from si to ti and \tlj2) from S2 to t2 simultaneously with a fidelity 
strictly greater than 1/2. (ii) If one of \ipi) and \ip2) is classical, then the fidelity can be improved 
to 2/3. (iii) Similar improvement is also possible if IV'i) and \'ip2) are restricted to only a finite 
number of (previously known) states, (iv) Several impossibility results including the general upper 
bound of the fidelity are also given. 

1 Introduction 

In f3], Ahlswede, Cai, Li and Yeung showed that the fundamental law for network flow, the max-flow 
min-cut theorem, no longer applies for "digital information flow." The simple and nice example 
in [3] is called the Butterfly network as illustrated in Fig. [TJ The capacity of each directed link is 
all one and there are two source-sink pairs: si to ti and S2 to ^2- Notice that both paths have to 
use the single link from sq to to and hence the total amount of (conventional commodity) flow in 
both paths is bounded by one, say, 1/2 for each. In the case of digital information flow, however, 
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the protocol shown in Fig. [2] allows us to transmit two bits, x and y, simultaneously. Thus, we can 
effectively achieve larger channel capacity than what can be achieved by simple routing. This is 
known as network coding since ^ and has been quite popular (see e.g.. Network coding home page 
[20] or P [la m mi [22] for recent developments). 

Network coding obviously exploits the two side links, si to t2 and S2 to ti, which are completely 
useless graph-topologically. Now the primary question in this paper is whether this is also possible 
for quantum information: Our model is the same butterfly network with (unit-capacity) quantum 
channels and our goal is to send two qubits from si to ti and S2 to t2 simultaneously. To this 
end, one should notice that the protocol in Fig. [2] uses (at least) two tricks. One is the EX-OR 
(Exclusive-OR) operation at node sq; one can see that the bit y is encoded by using x as a key which 
is sent directly from si to t2, and vise versa. The other is the exact copy of one-bit information at 
node to- Are there any quantum counterparts for these key operations? 

Neither seems easy in the quantum case: For the copy operation, there is the famous no-cloning 
theorem. Also, there is no obvious way of encoding a quantum state by a quantum state at sq- 
Consider, for example, a simple extension of the classical operation at node soji-^-, a controlled 
unitary transform U as illustrated in Fig. [3l (Note that classical EX-OR is realized by setting 
U = X "bit-flip.") Then, for any U, there is a quantum state \(f)) (actually an eigenvector of 
U) such that \4>) and U\4>) are identical (up to a global phase). Namely, if |^i) = It/*), then the 
quantum state at the output of U is exactly the same for |'(/'2) = |0) and IV'2) = This means 
their difference is completely lost at that position and hence is completely lost at ti also. 

Thus it is highly unlikely that we can achieve an exact transmission of two quantum states, 
which forces us to consider an approximate transmission. As an approximation factor, we use a 
(worst-case) fidelity between the input state iV'i) at si (IV'2) at S2, resp.) and the output state pi 
at ti [p2 at t2, resp.) Recall that the fidelity is at most 1.0 by definition and 0.5 is automatically 
achieved by outputting a completely mixed state. Thus our question is whether we can achieve a 
fidelity of strictly greater than 0.5. 

Our Contribution. This paper gives a positive answer to this question. We first show that 
we do need the (topologically useless) side channels for our goal exactly as in the classical case 
(Theorem 12. ip . Namely, without them, we can prove that for any protocol, there exists a quantum 
state l^j) {i = 1 or 2) and its output state pi such that F(|V'i),Pj) < 1/2. We then give our 
protocol which achieves a fidelity of strictly greater than 1/2 for the butterfly network (Theorem 
13. ip . The idea is discretization of (continuous) quantum states. Namely, the quantum state from 
S2 is changed into classical two bits by using what we call "tetra measurement." Those two bits are 
then used as a key to encode the state from si at node sq ("group operation") and also to decode 
it at node ti. Our protocol also depends upon the approximate cloning by Buzek and Hillery [9j. 
This obviously distorts quantum states, but interestingly, it also has a merit (creating entanglement 
between cloned states) by which we can handle the second problem on the state distinguishability 
previously mentioned. 
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Note that the present general lower bound for the fidelity is only slightly better than 1/2 (some 
0.52). However, if we impose restriction, the value becomes much better. For example, if 
is a classical state (i.e. either |0) or |1)), then the fidelity becomes 2/3 (Theorem 14. ip . Similar 
improvement is also possible if {ipi) and IV'2) are restricted to only a finite number of (previously 
known) states, especially if they are the so-called quantum random access coding states [4|. By 
using those states, we can design an interesting protocol which can send two classical bits from si 
to ti (similarly two bits from S2 to but only one of them, determined by adversary, should be 
recovered. It is shown that the success probability for this protocol is 1/2 + \/2/16 (Theorem 15. ip . 
but classically the success probability for any protocol is at most 1/2. 

On the negative side, several upper bounds for the fidelity are given. Again, the most general one 
(Theorem 13. lOp may not seem very impressive (some 0.983), but it is improved under restrictions. 
In particular, if we impose the BC (bit-copy) assumption, we can prove an upper bound of 11/12 
(Theorem l4.2p . (BC means that whenever we need to copy a classical bit, we use the classical (exact) 
copy, which seems quite reasonable.) We also give a limit of transmitting random access coding 
states. Note that Theorem 15.11 can be extended to the three-bit case (with success probability some 
0.525) but that is the limit; no protocol exists for the four-bit transmission with success probability 
strictly greater than 1/2 (Theorem 15. 3p . 

Related Work. We usually allow approximation and/or errors in quantum computation, which 
seems to be an essence of its power in some occasions. One example is observed in communication 
complexity: The quantum communication complexity to compute the equality function EQn ex- 
actly is n [E]. However, even one qubit communication enables us to compute EQn with success 
probability larger than 1/2. Another example can be seen in locally decodable codes and private 
information retrievals: Any 2?i-bit Boolean function F can be computed with success probability 
> 1/2 from an (n -|- l)-qubit information [31]. Namely, n + 1 qubits can encode 2n classical bits for 
computing any Boolean function approximately. 

Thus "1/2 -|- e for very small e" seems very powerful. Interestingly, this is not the case in some 
other occasions, the Nayak bound [24] says that there is no way to send two bits by one qubit 
with success probability > 1/2. Moreover, [T7] shows that one-qubit random access coding for four 
bits can only be done with success probability at most 1/2, although we can enjoy a good success 
probability up to three bits. In this context, our model in this paper also shows a clear difference 
depending on whether or not the two side links exist. 

The study of coding methods on quantum information and computation has been deeply ex- 
plored for error correction of quantum computation (since [30]) and data compression of quantum 
sources (since [28]). Recall that their techniques are duplication of data (error correction) and 
average-case analysis (data compression). Those standard approaches do not seem to help in the 
core of our problem. More tricky applications of quantum mechanism are quantum teleportation 
[6], superdense coding [7], and a variety of quantum cryptosystems including the BB84 key distri- 
bution [5]. The random access coding by Ambainis, Nayak, Ta-shma, and Vazirani [4] is probably 
most related one to this paper, which allows us to encode two or more classical bits into one qubit 
and decode it to recover any one of the source bits. Our third protocol is a realization of this 
scheme on the Butterfly network. 

The introduction of quantum network coding [16] triggered several new studies: Leung, Oppen- 
heim, and Winter [23j examined the asymptotic relation between the amount of quantum informa- 
tion and channel capacities on the Butterfly network (and more). Shi and Soljanin [29] considered 
multicasting networks from the viewpoint of lossless compression and decompression of copies of 
quantum states. 
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Figure 4: Quantum circuit for coding on the But- 
terfly network 




Figure 5: Protocol XQQ. 



2 The Model 

Our model as a quantum circuit is shown in Fig. HI The information sources at nodes si and S2 
are pure one-qubit states \ipi) and \'ip2)- (It turns out, however, that the result does not change 
for mixed states because of the joint concavity of the fidelity [25].) Any node does not have 
prior entanglement with other nodes. At every node, a physically allowable operation, i.e., trace- 
preserving completely positive map (TP-CP map), is done, and each edge can send only one qubit. 
They are implemented by unitary operations with additional ancillae and by discarding all qubits 
except for the output qubits [21 [25] . 

Our goal is to send to node ti and \ip2) to node t2 as well as possible. The quality of data 
at node tj is measured by the fidelity between the original state \ipj) and the state Pj output at 
node tj by the protocol. Here, the fidelity between two quantum states p and cr are defined as 

as in \10\ [HI [11]. (The other common definition is Tt\/ p^/^ap^/"^ .) In 



F{<7,p) 

particular, the fidelity between a pure state 1-0) and a mixed state p is F(|0),p) = (iplpltp). (To 
simplify the description, for a pure state \tp){tp\ we often use the vector representation \^p) and we 
also use bold fonts for a2x2or4x4 density matrix for exposition.) We call the minimum of 
F{\il>i),pi) over all one-qubit states \ipi) and 1-02) the fidelity at node ti and similarly for fidelity at 
node t2. 

Before presenting our protocols achieving a fidelity of strictly greater than 1/2, we show that 
the two side links, which are useless graph-topologically, are indispensable. One might think this is 
trivial from the Nayak bound [2^. Namely, if the two inputs are classical 0/1 bits, then they cannot 
be sent using a single quantum channel (sq to to) with success probability (= fidelity) greater than 
1/2. This is not true since our definition only requires a fidelity at each sink. In fact, we can achieve 
a fidelity of at least 0.75 in our definition, by simply using the one-qubit random access coding for 
two bits [3] and the phase-covariant cloning (a kind of approximated cloning) [8l[TT]. (Note that 
0.75^ > 0.5 but this does not violate the Nayak bound since the success probabilities at the two 
sides are not independent.) The proof of the following theorem needs a careful consideration of 
physical operations on the Bloch ball (see, e.g., |12[ I27j ) and the trace distance. Notice that in 
this paper, the trace distance between two quantum states p and p' is defined to be ||p — p'\\tr 
without the normalization factor 2 as in [25]. (If two states are qubits, this distance is equal to the 
geometrical distance of the corresponding points in the Bloch ball.) 

Theorem 2.1 No quantum protocol can achieve fidelity larger than 1/2 if both side links are 
removed from the Butterfly. 



Proof. We show that, for any proper protocol, if the fidelity at t2 is larger than 1/2 (say, 1/2 + e 
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with e > 0) then the fidehty at ti is strictly less than 1/2. For our purpose, we consider the case 
where the sources at si and S2 are a qubit {tp) and a classical bit b, respectively. We can assume 
that they are sent to sq without any transformation (since otherwise their operations at si and S2 
can be delayed until sq). Now, let £}, be the images of the Bloch ball resulting from operations at sq 
when b is sent from S2- Let the distance between £q and £i be the minimum trace distance between 
any state in £q and that in £i. Then, the following lemma holds from the fidelity requirement at 

Lemma 2.2 The distance between £q and £\ is at least 4e. 

Proof. Let Cf, be the TP-CP map at sq when b is sent from S2- We can regard the operations at 
to and t2 along the path 82-^2 as the measurement defined by a POVM (positive operator-valued 
measure) {Eq,Ei}. (Recall that any measurement is defined by a POVM that is, each 

operator Ei is positive and Ei = I.) Then, to prove the lemma we need to show that for any one- 
qubit states IV'), IV'')' l|C'o(|V'))~C'i(l''/''))lli»- ^ 4e. However, by the fidelity requirement at for any 
IV'), IV'') and any 6 = 0, 1, it must hold that TT:{EbCb{\ip))) > 1/2 + e and Tr(£;bCi_fe(|V''))) < 1/2-e. 
Thus, we have HCodV')) - Ci{m)\\tr > Eb=o,i |Tr^f>(Co(|V)) - CidV'')))! > 4e, where the first 
inequality is obtained from the following fact: For any quantum states p, p', ||p — p'\\tr equals 
maxjpg Y^fj |TrFfc(p — p')| where the maximization is over all POVMs {Fq, Fi} [25j. □ By 

Lemma [2.2t the center of the Bloch ball is outside at least one of £q and £1. Now let J^t, be the final 
images at ti when b is the source at S2, and let T be the composite TP-CP map of to and ti along 
the path si-ti. Note that J-q = T{£q) and J-i = T{£i), and T is linear. Since T transforms the 
Bloch ball into an ellipsoid within the Bloch ball [12\ I27j. the center of the Bloch ball is outside one 
of ellipsoids J-'q and J^i, say J^q. This means that there exists some input state {ip) at si such that 
and its output state p^ at ti are in different half of the Bloch ball, that is, F{\7p),p^,) < 1/2. 
Therefore the fidelity at ti is < 1/2. □ 



3 Protocol for Crossing Two Qubits 

In this section we prove the following lower bound. 

Theorem 3.1 There exists a quantum protocol whose fidelities at nodes ti and t2 are 1/2-1-2/81 
and 1/2 + 2\/3/243, respectively. 

3.1 Overview of the Protocol 

Fig. [5] illustrates our protocol. Protocol for Crossing Two Qubits (XQQ). As expected, the approx- 
imated cloning is used at nodes si, S2 and to- At node sq, we first apply the tetra measurement 
to the state of one-qubit system Q3 and obtain two classical bits rir2. Their different four values 
suggest which part of the Bloch sphere the state of Q3 sits in. These four values are then used 
to choose one of four different operations, the group operations, to encode the state of Q2- These 
four operations include identity /, bit-flip X, phase-fiip Z, and bit-|-phase-flip Y. At node ti, we 
apply the reverse operations of these four operations (actually the same as the original ones) for 
the decoding purpose. 

At node t2, we recover the two bits rir2 (actually the corresponding quantum state for the 
output state) by comparing Qi and Qq. This should be possible since Q2 (~ Qi) is encoded into 
Q5 (~ Qe) by using rir2 as a key but its implementation is not obvious. It is shown that for this 
purpose, we can use the Bell measurement together with the fact that Qi and Q2 are partially 
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entangled result of cloning at node si. 

Remark. It is not hard to average the fidelities at ti and t2 by mixing the encoding state at 
ti with the BeU state (|00) + |ll))/\/2, implying 1/2 + 2(2 - V3)/27 ^ 0.52 at both sinks. 

3.2 Building Blocks 

Universal Cloning (UC). As the first tool of our protocol, we recall the notion of the approxi- 
mated cloning by Buzek and Hillery [9j, called the universal cloning. Let 1^*^) = "^(|01) + 
Then, it is given by the TP-CP map UC defined by 

C/C(|0)(0|) = ^|00)(00| + ^|*+)(*+|, C/C(|0)(1|) = ^|^+)(11| + ^|00)(M/+|, 
UC{\1){0\) = ^|11>(^+| + ^|^+>(00|, = ^|11)(11| + ^|*+)(*+|. (1) 

This map is intended to clone not only classical states |0) and |1) but also any superposition equally 
well by mixing the symmetric state l^*^) with |00) and |11) as the output. Let pi = Tv2UC{\ijj)) 
and p2 = TriUC{\iJj)), where Trj is the partial trace over the i-th qubit. Then, easy calculation 
implies that pi = P2 = + | " f > which means F{\ip),pi) = F{\iJ)),p2) = 5/6. We cah its 

induced map i— > pi (or ^ p2) the universal copy. 

Tetra Measurement (TTR). Next, we introduce the tetra measurement. We need the fol- 
lowing four states |x(00)) = cos^ilO) + e*''/'' sin6i|l), |x(01)) = cos^|0) + e'^*''/^ sin6'|l), |x(10)) = 
sin^lO) + e-*''/^cos6i|l), and |x(ll)) = sin6i|0) + e^''^/'^ cose\l) with cos^ 6* = 1/2 + ^/3/6, which 
form a tetrahedron in the Bloch sphere representation. The tetra measurement, denoted by TTR, 
is the POVM defined by {i|x(00))(x(00)|, i|x(01))(x(01)|, i|x(10))(x(10)|, i|x(ll))(x(ll)|}. 

Group Operation (GR). In what follows, let X = f ^ ^ j be the bit-fiip operation, Z = 



be the phase-flip operation, and Y = XZ. Notice that the set of unitary maps on 



1 
-1 

one-qubit states p ^ WpW'^ {W = /, Z, X, Y) is the Klein four group. The group operation 
under a two-bit string rir2, denoted by GR{p,rir2), is a transformation defined by GR{p, 00) = p, 
Gi?(p, 01) = Zp, GR{p, 10) = Xp, and Gi?(p, 11) = Yp. Note that we frequently use simplified 
expressions like Xp instead of XpX^ . 

3D Bell Measurement (BM). Moreover, for recovering \ip2) at node t2 we introduce another 
new operation based on the Bell measurement, BM{Q, Q') (or BM{cr)), which applies the following 
three operations (a), (b), and (c) with probability 1/3 for each, to the state <t (a 4x4 density matrix) 
of the two-qubit system Q (8i Q'. 

(a) Measure a in the Ben basis { I c^+) = Mli),|ci>-) = = m+m,\^-) = MUM' 

and output |0) if the measurement result for \^'^) or \^^) is obtained, and |1) otherwise. 

(b) Measure O" similarly, and output |+) if the measurement result for |$^) or |^^) is obtained, 
and |— ) otherwise. 

(c) Measure a similarly, and output |+') = ;^(|0) +i|l)) if the measurement result for \^^) or 
|^'~) is obtained, and |— ') = "^(|0) — «|1)) otherwise. 

3.3 Protocol XQQ and Its Performance Analysis 

Now here is the formal description of our protocol. 
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Protocol XQQ: Input l-^i) at si, and \ip2) at S2; Output pj^^ at ti, and p^^j at t2. 
Step 1. (Qi, Q2) = at si, and (Q3, Q4) = t/C(|V2)) at 52- 

Step 2. Q5 = GR{Q2,TTR{Qs)) at sq- 
Step 3. (Qe, Q7) = UCiQ^) at to- 

Step 4 (Decoding at node h and ts)- pL = GR{QT,TTR{Qi)), and p^^^ = BM{Qi, Qq). 

We give the proof of Theorem 13.11 by analyzing protocol XQQ. For this purpose, we introduce 
the notion of shrinking maps (also known as a depolarizing channel [25] ) , which plays an important 
role in the following analysis of XQQ: Let p be any quantum state. Then, if a map C transforms p 
to p • p + (1 — I for some < p < 1, then C is said to be p-shrinking. The following three lemmas 
are immediate: 

Lemma 3.2 If C is p-shrinking and C' is p' -shrinking, then C o C is pp' -shrinking. 

Lemma 3.3 If C is p-shrinking, F{p,C{p)) > l/2 + p/2 for any state p. 

Lemma 3.4 The universal copy is 2/ 3- shrinking. 

Computing the Fidelity at Node t^. We first investigate the quality of the path from si 
to ti. Fix p2 = \ip2){ip2\ as an arbitrary state at node S2 and consider four maps Ci: \ipi) ^ Q2, 
C2[p2]: 22^25)^^3^ Q5 — ^ Qj and C4[p2]: Q7 — > Po„t. We wish to compute the composite map 
Csiti = C'4[p2] o C3 o C2[p2] o Ci and its fidelity. We need two more lemmas before the final one 
(Lemma 13. 7p . 

Lemma 3.5 C3 o C2[p2] = C2[p2] o C3. 

Proof. We decompose the p-shrinking map into 

Qip) ^ pQii) + (1 _ p)C(°). Here, 
the 1-shrinking map C*-^-* is the identity and the 0-shrinking map C^^^ transforms any state to 
^. Clearly, C^^^ is commutative with C2[p2]. For showing the commutativity between C^^^ 
and C2[p2], we prove that, for any qubit p and any 2x2 matrix basis element \b){b'\ (where 
b,b' e {0,1}) on Q3, C^^\GR{p,TTR{\b){b'\))) = GR{C^^\p),TTR{\b){b'\)). The left-hand side is 
Ermip{r\TTR{\b){b'\)\r)^ since GR{p,TTR{\b){b'\)) = j:re{o,iy^ir\TTR{\b){b'\)\r)GR{r,p) and 

C^^^ is 0-shrinking. The right-hand side is 

GRiI/2,TTRi\b){b'\))= {r\TTRi\b){b'\)\r)GRir,I/2)= {r\TTR{\b){b'\)\r)^-. 

re{0,l}2 re{0,l}2 

Thus, by linearity, the p-shrinking map and C2[p2] are commutative. Now the proof is completed 
since C3 is 2/3-shrinking by Lemma 13.41 □ 

Lemma 3.6 (Main Lemma) C4[p2] o C2[p2] is ^-shrinking. (See below for the proof.) 
Lemma 3.7 For any jV^i), F{\^pl),Cs^tA\i^l))) > 1/2-^2/81. 

Proof. By Lemma [3.5| C^^t^ = C4[p2] o C2[p2] o C3 o Ci. C3 and Ci are both 2/3-shrinking 
by Lemma [3^ and C4[p2] o C2\p2] is ^-shrinking by Lemma \3M It then follows that Csiti is ^- 
shrinking by Lemma 13.21 and its fidelity is at least 1/2-1-2/81 by Lemma 13.31 □ 

Proof of Lemma 13.61 See Fig.[5]again. Since we are discussing C4[p2] oC'2[p2]5 let pi = 
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be the state on Q2, P2 = |V'2)(V'2| ~ ( h ) state at S2 and assume that Q5 = Q7. We 

calculate the state on Q20 Qs^ Q4, the state on Q5 Q4 (= Q7 (g) Q4) and pl^i in this order. For 
Q2 Qs (d) recall that p2 is cloned into Q3 and Q4 and so, by Eq.([T]) in Sec. 13. 2^ the state on 
Q2 ® Qs Q4 is written as 



Pi ® 



||00)(00| + ^(|01) + |10))((01| + (10|) + ^ ((|01) + |10))(11| + |00)((01| + (10|)) 



+ 1 (|11)((01| + (10|) + (|01) + |10))(00|) + y |11)(11| + ^(|01) + |10))((01| + (10|) 

^ Pi ® |o)(o| (||o)(o| + ||o)(i| + ||i)(o| + +P1 |o)(i| Q|i)(o| + y 

+ Pi ® |1)(0| (1\0){1\ + f/ ) +pi ® |1)(1| ® ( ^|0)(0| + (|0)(1| + f |1)(0| + ^|1)(1| ) . (2) 



Then, we apply the group operation to the first two bits of Q2 ® Qs ® Q4- In general, for Q^Q' , 
GR(Q,TTR{Q')) is given as follows (see Appendix for the proof). 

Lemma 3.8 Let p be the state on Q. Then, GR{Q,TTR{Q')) is the following TP-CP map: 

p ^ 10) (01 ^ ^vii, z)p + (1 - -L) . ^, p ^ 1 1) (II ^ -Ly(x, y)P+[^-^)-i 

p |0) (1| ^ ^{Vil, X)p - V{Y, Z)p + z(y (/, Y)p - V{Z, X)p)), 
p |1) (0| ^ ^iV{I, X)p - V{Y, Z)p - i{V{I, Y)p - V{Z, X)p)). 

Here, V{I,Z)p = \{Ip + Zp), and V{X,Y)p, V{I,X)p, V{Y,Z)p, V{I,Y)p, and V{Z,X)p are 
similarly defined. Those six operations are I -invariant (meaning it maps I to itself) TP- CP maps. 

Now the state on Q5 Q4 is obtained by applying Lemma [3T8l to Eq.(l2|). From now on, we omit 
the term for ^. Namely, if the one-qubit state is p + a^, we only describe p. This is not harmful 
since any operation in this section is /-invariant and hence the ^ term can be recovered at the end 
by using the trace property. Thus, the state on Q5 ® Q4 looks like 

-^y(/,Z)pi ® (||0)(0| + + -^y{I,Z)p^ (^|0)(1| + ||1)(0| 

+ ^Vil, X- 1, Y- +)pi ^1 1) (0| + ^V{I, X; I, Y; +) ® ^ 

+ ^Vil, X; /, Y- -)pi ® ^|0) (1| + i^y^I. X- 1, Y; -) ® |/ 

+ ^V{X,Y)p, ® Q|0)(0| + + -^V{X,Y)p^ ® (^|0)(1| + ||1)(0|) , (3) 

where V{I, X; I, Y; ±)p = V{I, X)p - V{Y, Z)p ± i{V{I, Y)p - V{Z, X)p), and the terms such that 
the state of Q5 is | are omitted. 

We next transform the state of Q5 ® Q4 to p^^^ by using Lemma 13.81 again. For example, 
V{I,Z)pi (g) |0)(0| is transformed to -^V{I, Z)V{I, Z)pi. To simplify the resulting formula, the 
following lemma is used (see Appendix for its proof). 
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Lemma 3.9 1) V{I , Z)V{I , Z)pi = V{X,Y)V{X,Y)pi = q |) 

2) V{I,Z)V{X,Y)pi = V{X,Y)V{I,Z)pi-- 

3) V{I,X)V{I,X)pi = V{Y,Z)V{Y,Z)pi = 

4) V{I,X)V{Y,Z)pi = V{Y,Z)V{I,X)pi = 

5) V{I,Y)V{I,Y)pi = V{Z,X)V{Z,X)pi -- 



CL u 


] 


n n 


)• 

/ 


1 


6+c \ 


2 


X 1 


b+c 


^ )- 


2 




1 


b+c 


2 


2 


h+c 


1 


2 


2 


1 


b~c \ 


2 




c~b 




2 


2 / 


1 


c-b \ 


2 




b-c 
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6; y(/,y)y(z,x)pi = v{z,x)v{i,Y)pi = 

7) For any two operators V,V' taken from any different two sets of {V{I,Z),V{X,Y)}, 
{V{I,X),V{Y,Z)}, and{V{I,Y),V{Z,X)}, VV'pi = l 



Now it is a, routine Ccilculcition (see Appendix for its sequence) to obtain 



out 



mi 7712 

where mi through 777,4 are equations using o, 6, c and d {e,f,g and h disappear). Using the fact 
that a + d = 1, we have p^^^ = ^pi + ^I. Recovering the completely mixed state omitted in our 
analysis, we obtain C4[/)2] ° C'2[P2](Pi) = 5P1 + § " ^- Thus, the map is ^-shrinking. □ 

Computing the Fidelity at Node t2. By analyzing the quality of the path from S2 to t2, 
we have F {\Tp2) , p'^t) > 1/2 + 2\/3/243. Its analysis is different from the previous one by the 
antisymmetry of the protocol. Details are given in Appendix. 



3.4 Upper Bounds 

The following theorem shows a general upper bound for the fidelity of crossing two qubits over 
Butterfly. Recall that we showed in Sec. 1 (also Fig. [3]) that the operation at sq must not resemble 
a controlled unitary operation. Thus, it must be a more general TP-CP map (unitary operation 
with some ancillae). The basic idea of the proof is by showing that a good TP-CP map, the one 
which results in the protocol with fidelity close to 1.0, can be "approximated" by a controlled 
unitary operation. Hence, the fidelity of sending two qubits over Butterfly must be bounded away 
from 1.0. Similar to the proof of Theorem 12.11 we use a geometric view of the TP-CP map on 
the Bloch ball. However, it is much complicated since we have to consider the side links. See 
Appendix for details (whose technique is similar to Theorem 14.21 of the next section which the 
reader is recommended to read first.). 

Theorem 3.10 Let q be the fidelity of a protocol for crossing two qubits simultaneously. Then, 
q < 0.983. 



4 Protocol for Crossing a Qubit and a Bit 

In this section, we consider the case where one of two sources (say, at ,82) is a classical bit. Under 
this situation, we can design a protocol, called as XQC (crossing a quantum bit and a classical bit), 
whose fidelity is much better than XQQ (see Appendix for details). The protocol is summarized in 
Fig. [6l where M[Bz]{Q) means that Q is measured in the basis Bz = {|0), |1)}. (Similar notations 
are also used for bases Bx = {|+), |— )} and By = {|+'), |— ')} later.) 
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Out^= 1 if otherwise Ouf= M[BJ(Q|)0 M[B^l(Qj.) Outt M[BJ(Q4)® M[B( KQv) 

Figure 6: Protocol XQC Figure 7: Protocol X2C2C 



Theorem 4-i XQC achieves the fidelities of 13/18 and 11/18 at ti and t2- (By averaging the 
fidelities at both sinks as before, we can also have a protocol whose fidelities are the same 2/3 at ti 
and t2-) 

On the contrary, assuming that the copies of the bit at S2 are sent to sq and ti, we can obtain an 
upper bound that is significantly better than Theorem 13.101 In general, this assumption, denoted 
as the BC (bit- copy) assumption, is reasonable since whenever we need to send a bit to multiple 
nodes in the network, simply sending its (classical) copies does not appear to cause disadvantages. 

Theorem Let p be the fidelity of a protocol for crossing a bit and a qubit under the BC 
assumption. Then, p < 11/12. 

Proof. Suppose that there is a protocol whose fidelity is 1 — e, and we wish to show e > 1/12. 
Here, we give the desired upper bound for the case that the capacity of the link from si to t2 is 
unlimited. In this case we can assume that the state sent from si is pure. Let \ip) and b be the 
inputs at nodes si and S2, respectively. By the Schmidt decomposition (see the state after 

the operation at si is written as |^) = a|^2)|V'i) + /5|V'2')lV'i") where \Tpi) and are single-qubit 
orthonormal states on the link to sq and \ip2) and IV'2') the remaining (possibly multi-qubit) 
orthonormal states on the link to t2- Note that a, (5, IV'2) and IV'i) depend on the input at si. 
Without loss of generality, we assume \a\ > \/3\ (and hence < 1/2). 

We first investigate the fidelity on the path from si to ti, which is done by the following sequence 
of definitions and observations: (i) By the above definition of |^), we can write the state on Q2 
(where we use the notations in Fig. [6] again) as p = |ap|'i/'i)('i/'i| + (h) Intuitively, 

the value of |/3| shows the strength of entanglement between Qi and Q2', if it is large then the 
distortion of p compared to the original |0 must also be large. In other words, /? must be small 
to obtain a small e. (iii) For 6 = and 1, let Cb Q2 ^ Qs be the TP-CP map at sq. Let C^ 
be the corresponding affine map on Bloch-sphere states. Namely, maps a Bloch vector r to 
O^AfeO^r + dfe, where and are orthogonal matrices with determinant 1, and is a diagonal 
matrix (see |12l 127] ). (iv) Let Uj^ be the map that transforms r to 0\0^f. Then, we can define the 
map C/fc such that its Bloch-sphere correspondence is U^. Note that is unitary, (v) Let fcj, be the 
distance between the images of the Bloch ball by and U^. Note that \\{Ch — Uh)\4>){(l)\\\tr < kb for 
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an arbitrary pure state |(/)) (where the trace norm || • ||jr is defined by ||^||tr = V j4j4t). By a similar 
reason as (ii) kf, must be smah for a small e. (vi) Now we select the state p which is undesirable 
to achieve a high fidelity, i.e., the one such that Uop = Uip (such p exists, which is parallel to 
the eigenvector of Uq^Ui). Let p' = |qP|V'i)('!/'i|) which is an approximation of p represented as a 
product state, (vii) The operation at is considered to be the two TP-CP maps on the one qubits: 
One map CPi is for ti and the other CP2 is for t2- Their Bloch-sphere correspondence CP[ and 
CP2 have a trade-off on the size of their images. So, the image of CP{ must be large for a small e, 
and then we have a shrinking factor for (7^2- 

Now we are ready to bound both above and below 1 1 (Cq — Ci)p'| It,., which produces an inequality 
on e as will be seen soon. For this purpose, we first evaluate the values of /? and kf, using geometric 
properties of the Bloch sphere representation of the TP-CP map on the one qubits: it maps the 
Bloch ball to an ellipsoid within the Bloch ball. The proof of this technical lemma is given in 
Appendix. 



Lemma 4.3 < i/(e) and kb < /(e) where /(e) = | + e - J| + e2 - 5e. 



Second, we decompose ||(Co — Ci)p'\\tr as follows by the triangle inequality, and then bound it 
from above: 

1 1 (Co - Ci)p'\\tr < 1 1 (Co - Uo)p'\\tr + ||^7op' - Uop\\tr + \\Uip - Uip'\\tr + ||(C/l " Ci)p'\\tr 

< |a|^ • /cq + Hp - p'lltr X 2 + |ap • /ci 

< {ko + ki)\a\^ + 2\p\\ (4) 
Third, for the shrinking factor by the operation at to the following lemma from [26] is used. 

Lemma 4-4 (Niu- Griffiths) Let CP- be the Bloch sphere representation of CPi. Let li he the 
shortest semiaxis length of the image of CP[, and I2 he the longest semiaxis length of the image of 
CP^. Then, h < ^J\-t\. 

Since /i > 1 — 2e by the fidelity requirement at ti. Lemma 14.41 gives us the condition for l^: 



h < 2Ve-e2. (5) 

Finally, we bound ||(Co — Ci)p'\\tr from below by focusing on the path 52-^2- Let M be the 
TP-CP map done at t2, and L> = M(/ CP2){I ® Co - / ® Ci). By the fidelity requirement at t2, 
1 1-^10(^1 1 |ir > 2 — 4e [2]. On the contrary, using the unnormalized product state |x) = a|V'2)|'0i) 
we bound ||^|0(^llkr- by 

\m){mtr<\\D{\0{C\-\x){x\)\\tr + \\D\x){x\\\tr. 

The first term is bounded by 2|||0(,^| — |x)(xll|ir since D is the difference between two TP-CP 
maps, each of which has the operator norm at most 1 [2]. Using the monotone decreasing property 
of the trace distance between two states by TP-CP maps, the second term is bounded by 

\\D\x){x\\\tr < ||(/^ (CP2 • (Co - Ci)))\i^2){i^2\ ^p'lltr = 1 1 (CPs • (Co - Ci))p'\\tr, 

which is at most ZslKCo — Ci)f/\\tr since CP2 maps the Bloch ball to an ellipsoid within a ball with 
radius at most l2- By a simple calculation of the trace norm, we have the following bound. 



Lemma 4-5 - \x){x\\\tr < 2|/3| ^1 - V2- 
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B 



B 



Figure 8: Image by the operation at si 



Figure 9: Image by operations at sq, to and ti 



By Lemma 14.51 we have 



2 - 4e < 21110(^1 - \x){x\\\tr + hWiCo - C,)p'\\tr < 2|/?| y^l - |/3|V2 + /sIKCq - Ci)p'\\tr. (6) 



e and while its left-hand side is monotone decreasing on e. Therefore, by checking e such that 
Ineq. ([7]) holds under the bound of from Lemma l4.3( we obtain e > 1/12. 
It still remains to prove Lemma 14.31 

Proof of Lemma 14.31 We only prove the bound of |/?| since the bound of kb is similarly shown. 

Let Pmax be the maximum of all /3's when \^) varies on the pure qubits. Considering the Bloch 
sphere representation, the point A corresponding to p is on the circle of radius 1 — 2\Pmax\'^ since 
p = (1 — 2|/?m,aa;P)|V'i)(V'i| + 2|/3maxP ' ^- Note that the image of the Bloch ball by the operation 
at si is an ellipsoid whose cut CD parallel to segment AO has length < 2 — 2\f3max\'^ (see Fig. [8]), 
where O is the center of the Bloch ball. Then, by geometric properties of the ellipsoid we can show 
the following lemma. 

Claim 1 After the operation at ti, this cut is shrunk by a factor at least 1 — 2\(3max\'^ + 2e. 

Proof. See Fig. [8] again. Let P be the point on the line AB such that the length of segment PO is 
1 — 2e. To satisfy the fidelity at ti, some point P' in the image at sq must reach P in the final image 



at ti. Letting / be the length of P'P, this means that the composite map by operations at *o 



and ti shrinks the Bloch ball by a factor of 1 — / to the direction of P' P since any TP-CP map must 



transform the Bloch ball to an ellipsoid inside the ball. Let v be the component of P' P parallel to 
the line AB. Note that the length of v is at least (1 — 2e) — (1 — 2|/?maxP) = 2|/3maxP — 2e. Now we 
analyze the maximum of the shrinking factor of the Bloch ball to the direction of AB since it is the 
worst case for our analysis. Since we want to know the maximum, we can assume that the length 
of V is exactly 2\f5max\^ — 2e. Then, the angle 9 between P'P and v satisfies cos 6* = Hli^in^iLzHl . 
Notice that the ellipse (yz^)^ + = 1 (Fig. [9]) is obtained by the projection of the final image to 



By Lemma Ineqs.(|l]), ([5]) and ([6]), we produce an inequality on e and 



(Recall that \a 
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the plane including all the vectors we are considering. (Here, we assume that the plane has x-y 

> 

coordinates. Note that the x-axis is the direction parallel to P'P.) Let (xo,yo) be the intersection 
of the ellipse and the line y = (tan^)a;. We can see that \/x'q + y^ is the shrinking factor we want. 
By a simple calculation, this value is 



H + yo = J(l + tan2^)- 



l{l-lf 



+ tan2 e V 2|/3^,,|2 - 2e + (1 - - 2|/3^„,|2 + 2e) ' 



which is monotone decreasing as the function of / (when / < 1). Since I > 2|/3maxP — 2e, the 
maximum value is obtained when / = 2|/3maxP — 2e and it is 1 — 2|/3maxP + 2e. □ 

After the operation at ti, the distance between the Bloch sphere and its image by the oper- 
ations along the si-ti line must be at most 2e to satisfy the fidelity requirement at ti. Thus, 
the shortest semiaxis length of the final image of all transformations on the si-ti line must be 
at least 1 — 2e. On the contrary. Lemma [1] implies that the shortest semiaxis length is at most 
(1 - |/3maaf )(1 - 2|/3„aaf + 2e). Hence, 1 - 2e < (1 - \(imax?){l - 2\(5^ax? + 2e), and we obtain 



|/3maa;P < + + ^^j • definition of (3max we also have the same bound on 

1/3 1 2 for any j3 corresponding to an input at si. □ 

Now the proof of Theorem 14.21 is completed. □ 



5 Protocols for Crossing Two Multiple Bits 

In this section, we consider the case that both sources are restricted to be one of the four (2, 1, 0.85)- 
quantum random access (QRA) coding states [4j. Note that (m,n, p)-QRA coding is the coding of 
m bits to n qubits such that any one bit chosen from the m bits is recovered with probability at 
least p. In this case, we can achieve a much better fidelity. As an application, we can consider a 
more interesting problem where each source node receives two classical bits, namely, xiX2 € {0, 1}2 
at si, and yiy2 £ {0, 1}^ at S2- At node ti, we output one classical bit Out^ and similarly Out^ at 
t2- Now an adversary chooses two numbers ^1,^2 £ {1)2}. Our protocol can use the information of 
ii only at node ti and that of 12 only at t2- Our goal is to maximize F{xi^, Out^) and F{yi^, Out^), 
where F(xi^,Out^) turns out to be the probability that Xi^ = Out^ and similarly for F{yi^,0\x\?). 
Fig. [7] illustrates X2C2C whose key is also on how to encode at sq: it uses measurement MM2 to 
estimate which QRA coding state is sent from S2, and the group operation similar to XQQ. For 
optimal cloning at Iq, it uses the phase-covariant cloning [8l[Il]. Its details are given in Appendix. 

Theorem 5.1 X2C2C achieves a fidelity of 1/2 + \/2/16 at both ti and t2- 

By contrast, any classical protocol cannot achieve a success probability greater than 1/2 for the 
following reason: Let fix 2/1 = 2/2 = 0. Then the path from si to ti is obviously equivalent to the 
(2, l,p) -classical random access coding, where the success probability p is at most 1/2 [4J. 

Extending X2C2C, we can also solve the above problem with probability > 1/2 for the case 
when each source node receives three bits. The protocol is denoted as X3C3C whose details 
are given in Appendix. In particular, X3C3C needs eight different operations instead of four in 
X2C2C . In addition to the Pauli operations, it uses an approximation of the universal NOT gate 
|101 113] . which maps a point within the Bloch sphere into its antipodes. 

Theorem 5.2 X3C3C achieves a fidelity of 1/2 + 2/81 at both sinks. 
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Figure 10: Network Gk 



Interestingly, there is no XACiC, which is an immediate corollary of the nonexistence of 
(4, l,p> l/2)-QRA coding ^7\. 

Theorem 5.3 If an XACAC protocol achieves fidelity q, then q < 1/2. 

6 Beyond the Butterfly Network — Concluding Remarks — 

Obviously a lot of future work remains. First of all, there is a large gap between the current upper 
and lower bounds for the achievable fidelity, which should be narrowed. Equally important is to 
consider more general networks. To this direction, it might be interesting to study the network Gk 
as shown in Fig. IIOI introduced in [Ijj. Note that there are k source-sink pairs {si,ti) all of which 
share a single link from sq to t^. For this network Gk, we can design the protocol XQ^ by a simple 
extension of XQQ. The idea is to decompose the node sq (similarly for to) into a sequence of nodes 
of indegree two. At each of those nodes, we do exactly the same thing as before, i.e., encoding 
one state by the classical two bits obtained from the other state. It is not hard to see that such a 
protocol achieves a fidelity strictly better than 1/2. 
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A Appendix 

A.l Proofs of Lemmas in Sec. 13.31 



Proof of Lemma 13. 8L Consider the tetra measurement as a TP-CP map. For any mixed state 
p, its TP-CP map, also denoted by TTR, transforms p to 



Tr 

+ Tr 



2lx(00))(x(00)|p 



1 00) (00 1 +Tr 



^|x(01))(x(01)|p 



|01)(01| 



|x(io))(x(io)|p 



|10)(10| +Tr 



|x(ii))(x(ii)|p 



|11)(11|. 



(8) 



By linearity, TTR is defined by the map that transforms each basis matrix \b){b'\ (b,b' = 0,1) 
to the matrix obtained by replacing p in Eq.([8]) by \b){b'\. Using the definition of the states 
Ix(OO)), . . . , Ix(ll)) we obtain 

TTi?(|0)(0|) = i(cos2 0(|OO)(OO| +|01)(01|) +sin2 0~(|lO)(lO| + |11)(11|)) 



2 

^^10X01 4 



2sm'^e[ -(g)- + (cos^ 6* - sin^ 6i) |0)(0| 0- 



+ 1 



1 

V3 



Similarly, we can check that 
TTR{\1){1\) 
TTRi\0){l\) 



V3 
1 



+ 1 



1 

V3 



4^/3 

+^(|00)(00| +|11)(11 

rri?(|i)(o|) = rTit:(|o)(i|)t. 



((|00)(00| + |10)(10|-|11)(11|-|01)(01|) 
|01)(01|-|10)(10|)) 



(9) 



(10) 



(11) 
(12) 



Now we consider the TP-CP map of GR{Q,TTR{Q')). Assume that the state of Q is p. Recall 
that GR{p, |00)(00|) = p, GR{p, |01)(01|) = Zp, GR{p, |10)(10|) = Xp, and GR{p, |11)(11|) = Yp. 
If the GR operation under the two bits being selected uniformly at random, which means that 
the state of TTR{Q') is the state | |, is applied to p, then p is mapped to | since the four 
GR operations are evenly applied to p. Thus, Eqs.® and ([TO]) imply that GR{-,TTR{-)) maps 
p0|O)(O| andp®|l)(l| to -^^£^ + {1-^)^ and ^^£±^ + (1 - -^)§, respectively. Moreover, 
by Eq.(fTT|l p (gi |0)(1| is mapped to 

((/p + Xp) - {Yp + Zp) + i{{Ip + Yp) - {Zp + Xp))), 



4^3 



which is i^{y{I, X)p - V{Y, Z)p + i{V{I, Y)p - V{Z, X)p)). By Eq.^ it is clear that p |1)(0| 
is mapped to ^{V{I, X)p - V{Y, Z)p - i{V{I, Y)p - V{Z, X)p)). 
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Next, we show that V{I, Z), which maps p to \{Ip+Zp), is an /-invariant TP-CP map (similarly 
shown for the other five operations). In fact, V{I,Z) is a TP-CP map since it is implementable 
by the following operation: Choose a bit r uniformly at random, and apply Z to p if r = 1. Its 
/-invariance comes from the fact that the Pauli operations are /-invariant. □ 

Proof of Lemma 13.91 Let p = ( ^ ^, I • Then, we can check that 

\c d J 

zp=(\ xp=(t Yp 



c d J ^ \ b a J '' \ —b a 

Thus, V{I, Z) is the TP-CP map that maps p to V{I, Z)p = ^ ^ . Similarly, we can see that 

V{X,Y), V{I,X), V{Y,Z), V{I,Y), and V{Z,X) are TP-CP maps that map p to V{X,Y)p = 

( - — \ 

and V{Z,X)p = ( ^ J, respectively. Using these TP-CP maps, we can check that l)-7) 

hold. □ 



Calculation of p\uf Here, we give the calculation to obtain p^^^ in Sec. 13.31 Recall the state on 
Q5 ® Q4 (Eq. ([3])). Using Lemma [3^ 7) and Lemma [3^ the state pl^^ is represented as 



1 

71 



+ 



+ 



1 



2V3 
1 



^v{i, z)v{i, z)p^ + Y)v{i, z)p. 



^V{I, X- /, Y- -)V{I, X- /, Y- +)pi + 

^y(X, Y)V{X, Y)pi + lv{I, Z)V{X, Y)pi 
6 o 



ViI,X;I,Y;+)ViI,X;I,Y;-)pi 



(13) 



where the terms | produced from the second, fourth, sixth, and eighth terms of Eq.Q by Lemma 
3.8( 7) are omitted. Moreover, Eq.(|13p is rewritten as follows using Lemma 13.8( 1-2) for the first 
and last terms of Eq. (113p and Lemma l3. 8( 3-7) for the second and third terms of Eq. (|13p : 
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12 



b+c 
2 



1 

2 2 

b-c 1 
2 2 



a\ b+c 1 



X 4 



X 4 



6 V 



b+c 1 



b+c 
2 



X 4 



where the terms ^ produced by Lemma [3^ are omitted. Using e + h = a + d = 1, the above formula 
is finally rewritten as ^pi -|- ^/. 



A. 2 Computing F{\^p2),p', 



out) 



We investigate the quality of the path from S2 to t2. Fix pi = as an arbitrary state at 

node si, and consider four maps Di: IV'2) —>■ Qs, D2[pi]: Q3 — > Q5, i^s: Q5 Qe and D4[pi]: 
Qe — > Po^i . We wish to compute the fidelity of the composite map Ds2t2 = [pi] 0D30D2 [pi] o Di . 
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Lemma A.l D3 o 1^2 [pi] = D2[pi] o D3. 



Proof. As with Lemma 13.51 it suffices to show that C^^^ is commutative with [pi]- For this 
purpose, we prove that, for any qubit p and any matrix basis element (where b, b' G {0, 1}) on 

Q2, C^^\GR{\b){b'\,TTR{p))) = GR{\b){b'\,TTR{C^^\p))). We first evaluate the left-hand side. 
Let Too (resp. Tqi, Tiq, Tu) be the map that transforms p to Ipl"^ (resp. ZpZ\ XpX\ YpY^). 
Since C^^'^ is 0-shrinking, 

CW(Gi?(|6)(6'|,rri?(p))) = CW I Yl {r\TTRip)\r)Tri\b){b'\ 

\r6{0,l}2 

= Y {r\TTRip)\r)TroC^^\\b){b'\) = \^ ^l^^ 

rG{0,l}2 I 2 V )■ 

Here, we used the commutativity between C^^^ and the group operations for the second equality. 
Next, we evaluate the right-hand side: 



GR{\b){b'\,TTR{C^^\p)))= Y {r\^2^^^\r)Tr{mb'\) 

re{0,l}2 



re{0,l}2 

Here, the first equality is obtained since the tetra measurement for | gives two bits uniformly at 
random, and the third equality is obtained since /|fe)(6'|lt + Z\b){b'\Z^ + X\b){b'\X'f + Y\b){b'\Y^ 
is 2/ if 6 = 6', and O otherwise. □ 



Lemma A. 2 (Main Lemma) D^lpi] o D2\pi] is I-invariant and for any pure state \'tp2), 
F{\^P2),DM ° D2\pi]{\%b2))) = 1/2 + V3/54. 

Lemma A. 3 For any pure state \i;2), F{\ip2) , Ds.,t2i\^J2))) = l/2 + 2V^/243. 

Proof. ByLemmaim D^^ti = Di\pi]oD2\pi]oD^oDi. By Lemmas and [331 D^oDi{\'4)i)) = 
||V'2)(V'2| + i-i ByLemmaEa wehaveD,,t,(|V^2)) = I)4[pi]o2?2[pi](||V'2)(V'2| + |-i) = Ip+f-f 
for some p such that F(|V2>,p) = \ + ^- Thus, F(|^2>, ^^..t^ (IV'2») = |(i + || ) + f • ^ = | + 



Proof of Lemma lA. 21 It is not hard to see that -D4[pi] o D2IP1] is /-invariant from the following 
description. To compute -D4IP1] o D2\pi]{\4>2)) , let \il)2) = cos0i|O) + e*^^ sin6'i|l) be the state on 

Q3, Pi ~ ^ ^ ^ ) ' ~ ^['^1^2] be the probability that rir2 is obtained by the tetra 

measurement of Q3. Then, we have the following values. 
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Lemma A. 4 



1 a/3 

^^[00] = 4 + (cos 201 + sin 201 (cos 02 + sin ^2)) , 
1 \/3 

p[01] = - + ^ (cos 26'i + sin 26*1 (- cos 02 -sm02)), 
1 \/3 

p[lO] = - + ^(- cos 26*1+ sin 26*1 (cos 6*2 -sin 6*2)), 
1 /3 

p[ll] = - + ^(- cos 26*1 + sin 26'i(- cos 6'2 + sin 6'2)) 



Proof. Let p2 = { { ) . Then, 



p[m] = Tr 



^lx(oo))(x(oo)| ( I 



= ^ (e cos^ ^ + /i sin^ + fsm0 cos ^e*''/^ + /* sin cos ^e"*''/^) . 

Similarly, we obtain 

p[Ol] = ^{ecos^0 + h sin^ ^ + / sin ^ cos ^e'^*^/^ + /* sin cos ^e^*^/^) , 

p[10] = ^(esin2^ + /tcos2^ + /sin^cos^e-'''/'' + /*sin^cos^e'''/''), 

p[ll] = ^ (e sin^ + h cos^ + fsm0 cos ^e^*''/^ + /* sin ^ cos ^e'^*^/^) . 

Because e = cos^^i, h = sin^^i, / = e""'^^ gj^^^ (.qs ^i, and cos^ ^ = 1/2 + \/3/6 (and hence 
sin 6^ cos 6* = l/\/6), p[00] is rewritten as 

pM = 1(^1 + ^(cos^ ^1 - sin^ 0,) + -L sin^i cos^i (e"^'^^ + e^'^^ 
1 \/3 

= - + — (cos 2611 + sin26'i(cos6'2 + sin 6*2)), 

which is the desired value. Similarly, we can calculate the desired values of p[01],p[10],p[ll]. □ 
Then, after the group operation, the state on Qi Q5 = Qi <8) Qe can be written as 
a =p[00]p(/) +p[01]p(Z) +p[10]p(X) +p[ll]p{Y), 
where p{I) , . . . can be given by the following lemma: 
Lemma A. 5 For W G {/, X, Y, Z}, 

P{W) = (y|0)(0| + i|l)(l| + ^|0)(l| + ||l)(0|)c5Ty(|0)(0|) 

+ Q|1)(0| + ® W(|0)(1|) + Q|0)(1| + ® W(|1)(0|) 

+ Q|0)(0| + y + ^|0)(1| + ^|1)(0|) ® W (|1)(1|) . 
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Operation\Bell states 


|$+) 


Id)-) 


|^+) 




/ 


1/3 


1/3 


1/3 





Z 


1/3 


1/3 





1/3 


X 


1/3 





1/3 


1/3 


Y 





1/3 


1/3 


1/3 



Table 1: Probabilities that the measurement values for the four Bell states by the measurement in 
the Bell basis at t2 are obtained according to the approximated group operations at sq. 



Proof. By Eq.([T]), we can see that the state of the system Qi ® Q2 is 

(y|o)(o| + ^|o)(i| + ||i)(o| + i|i)(i|) |o)(o| + Q|i)(o| + ^7) ® |o)(i| 

+ Q|0)(1| + |7) |1)(0| + Q|0)(0| + ^|0)(1| + ||1)(0| + y ® |1>(1|, 

and hence we obtain the desired formula. □ 

Then, we apply the 3D Bell measurement to cr, obtaining = BMicr). For this calculation, 
we need the following lemma: 

Lemma A. 6 1) If W £ {I,Z} (£ {X,Y}, resp.), then by operation (a) we obtain the state 
i|0)(0| + I • § fi|l)(l| + I • I, resp.) as BM{p{W)). 

2) IfWe {I,X} (e {Y,Z}, resp.), then by operation (b) we obtain the state + | • | 
(\\-){-\ + I • i ^esp.; as BM{p{W)). 

3) IfW£ {I,Y} (£ {Z,X}, resp.), then by operation (c) we obtain the state ||+')(+'| + § " i 

+ 1 • i ^esp.; as BM{p{Wi,W2)). 

Proof. By calculating the probabilities that the measurement values for the four Bell states 
are obtained, we have Tabled) (This is checked by calculating (<i>+|p(l^)|<I)+), {^^\p{W)\^~) , 
{'^+\p(W)\'^+), and {^-\p{W)\'if-) for each W G {I,X,Y,Z}.) According to Table [II we can 
obtain the desired result by a simple calculation. For example, in case where W = Z is applied at 
So, by operation (a) we obtain the state (i + |)|0)(0| + (0 + |)|1)(1| = ||0)(0| + | • |. The other 
cases are similarly checked. □ 

Now we can compute pl^t = BM{a) = p[00]BM{p{I)) + ■■■ by summing up (l)-(3) of Lemma 
lAHwith weight 1/3 for each, which implies p^^^ ~ § ' ^ + gPO; where 

po = M00](|0)(0| + |+)(+| + |+')(+'|) +p[01](|0)(0| + |-)(-| + |-')(-'|) 

+ p[io](|i)(i| + 1+)(+| + !-')(-'!) +p[ii](|i)(i| + + 

We can check the following lemma by a simple calculation. 
Lemma A. 7 {i'2\po\tp2) = 3/2 + V3/6. 

Proof. By the definition of p[rir2], po = 3/2 + \/3pg/12, where 

p'o = (cos20i +sin2^i(cose2 + sine2))(|0)(0| + |+)(+| + !+')(+'!) 

+ (cos2ei +sin20i(-cose2 -sine2))(|0)(0| + |-)(-| + |-')(-'|) 

+ (-cos2ei + sin20i(cose2-sine2))(|l)(l| + !+)(+! + |-')(-'|) 

+ (-cos2ei + sin20i(-cos02 + sin02))(|l)(l| + |-)(-| + |+')(+'|). 
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Thus, it suffices to show that ('i/'2|PolV'2) = 2. We can rewrite Pq as 

= 2cos20i(|O)(O| - |1)(1|) +2sin20i cos02(|+)(+| - |-)(-|) 
+ 2sin2^i sin^2(|+')(+'| - |- )(- |). 

Recalhng that \ip2) = cos^i |0) + e*^2 sin 6*11), we can check that (V'2||0)(0| - |1)(1||'02) = cos2(9i, 
- |->(-||V'2) = sin2eicos02, and (V'2||+')(+'| - |-')(-'IIV'2) = sin26'i sin^a- Thus, we 
obtain (V'2|PolV'2> = 2 cos^ 26*1 + 2 sin^ 29i cos^ 02 + 2 sin^ 26*1 sin^ 6*2 = 2. □ 

By Lemma IXTI we finally obtain (V'2|pLi IV'2) = 3 + g (i + = 5 + This completes the 
proof of Lemma IA.2I □ 



A.3 Proof of Theorem \37l0\ 

Our bound is given under the case where the sources at si and S2 are a qubit \ip) and a classical 
bit b. Also, we assume that two side links have unlimited capacity, and then we can assume that 
the encoded states from sources are pure states. Suppose that there is a protocol with fidelity 
1 — e. Then, we show e > 0.017. Let \(,-,p)t2so be the encoded state sent from si, and \4'{b))soti 
be the encoded state sent from S2, where the subscript of the ket vector presents where they are 
in. By the Schmidt decomposition, they are written as: \£,ip)t2so = a|V'2)t2lV'i)so + /5|V'2')t2l'0i')so! 
and \4>{b))soh = lb\4>{b)i)so\4>{bh)ti + h\4>{b)i)so\4>{b)2)ti- Without loss of generality, |/3| < |a| 
and \Sb\ < hb\. Note that p^ = \a\^\iPi){^i\ + \P\^\i>i){2Pi\ (and p(6) = \j\^\c)){b)i){<Pib)i\ + 
\6\'^\4>{b)i){(j){b)i\, resp.) are the states after the operations at si (and S2, resp.) when we focus 
on the path from si to ti (the path from S2 to t2, resp.). Then, we have the following bounds on 
P and 6h. 

Lemma A. 8 and are at most ^ + e — y^'f + ~ , and \5o\ + \6i\ < 2^. 

Proof. The bounds on |/3| and \bh\ are obtained by the same proof as Lemma [4. 3i So, we consider 
the bound of |5o| + \b\\- The fidelity requirement at t2 gives us ||p(0) — p(l)||tr > 2 — 4e. Regard 
p(0) and p(l) as the points in the Bloch ball. By the triangle inequality, their distance is at most 
(1 - 2|5oP) + (1 - 2|(5in. Thus, |5oP + W < 2e. Then, it is easy to see that |5o| + l-^il < 2^e. □ 

Similar to the proof of Theorem 14.21 we lead to two bounds on e from the two paths. We first 
consider the path s\-t\. Let C be the TP-CP map at sq, and M\ be the composite TP-CP map 
by the operations at to and t\. Take an arbitrary \'\\)) and its orthogonal state The fidelity 

requirement at t\ gives us the condition 

1 1 Ml (C /) (pv, - p^x ) 1 0(6)) (<A(6) 1 1 1 > 2 - 4e. 
Note that, letting |0(6)) = |(/)(6)i)|0(6)2), 

\\\m)m)\ - \mmm\tr = 2^\-mb)\m)? = m- 

Thus, by using the triangle inequality 

||C(p^-p^x)|0(6)i)(0(6)i|||i, = ||(C'®/)(p^-p^x)|<A(6))(<A(6)|||i. 

> \\M^[c®i)[p^-p^^)\m)km\\\tr 
>\\M^{c®i){p^-p^^.)\m)m)\\\tr-\\M^{c®i){p^-p^^^^^^ 

> 2 - 4e - IIp^ - p^xllt, • 2\h\ > 2 - 4e - 4|5b|. 
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Let C{b) be the TP-CP map that transforms p to C{p® \4){h)i) {(l){h)i\) . Then, we have 

||C7(6)(|V)(VI - \i^^){i^^\)\\tr > \\C{b){p^-p^^)\\tr > 2-46-4|<56|. 
This leads to the condition 

\\C{bm{mr>l-^e-4\6t\ (14) 

since | |C(6)|^"'" )(-;/;-'" < 1- Recall that the Bloch sphere representation of C{b) is written as the 
map: Oi{b)A{b)02{b)'r + d{b) where Oi{b), 02(b) are orthogonal matrices with determinant 1, 
and A(6) is a diagonal matrix. Let U{b) be the unitary operator whose Bloch sphere representation 
maps a Bloch vector r to Oi{b)02{b)f. Now we take {ip) such that U{0)p^ = U{l)p^. Then, we 
evaluate ||(C(0) — C{l))p'^\\tr with p'^ = \a\'^\ipi){'ipi\ as follows: 

||(C7(0)-C(l))pVlkr 

< ||(C(0) - C/(0))pVlltr. + \\Ump'^-p^)\\tr + \\U{l)ip^ - p'^)\\tr + ||(C/(1) " C{l))p'^\\tr 
= \a\\\\{C{0) - C/(0))|Vi)(V'l||kr + ||(C(1) - C/(l))|Vl>(^l||kr.) +2||PV, - p'^^\\tr■ 

Noting Ineq.([IlD, I I |tr = 1 and \ \p^ - p'i^Wtr = we obtain 

||(C(0) - C{l))p'^\\tr < |ap(8e + 4|,5o| + 4|5i|) + 2\p\^. (15) 

Second, we consider the path 52-^2- Let M2 be the composite map by the operations at to and 
t2. By the fidelity requirement at t2, \\M2{I O C)\^^){^^\{p{0) - p(l))||tr > 2 - 4e. The left-hand 
side is at most 

||(/®C7)(|V2)(V'2|g5p')(p(0)-p(l))lkr + ||(/®C)(|e^)(CV'|-|V'2)(V'2|®p')(p(0)-p(l))||*r 
< \\Cip'ipiO)-pm\\tr + m^)m - \i^2){H<S)p'\\tr\\p{0)-pimtr 

< \\iC\0) - C'{l))p%r + 2|/3|Vl-|/?IV2 X 2, 

where C'{b) is the TP-CP map: a C{a®p{b)) and the last term of the right-hand side is obtained 
by the same calculation as Lemma 1131 Since p(6) = (1 — 2| Jf,p)|</)(6)i)((/)(6)i| + 2|(5;,p • |, C'{b) is 
decomposed into C'{b) = (1 — 2\5}j\^)C{b) + 2|(5fepC/ with some TP-CP map C/. Now we assume 
that |(5oP > l<^iP) which does not loss of generality. By the triangle inequality, 

\\{C'{Q)-C'{l))p'\\tr 

< 11(1 - 2|JoP)(C(0) - C{l))p'\\tr + ||(2|5o|' - 2\5i\^)C{l)p'\\tr + ||(2|5o|' - 2\5i\^)Cip'\\tr 

< (1 - 2|<5oP)||(C(0) - C(l))p'|k, +4|a|2(|5oP - \8i\^). 

Thus, we have 

2 - 46 < 4|/3|Vl-|/?|2/2 + (l - 2|5oP)||(C(0) - C{l))p'\\tr + MW^o? - (16) 

By Ineqs. ()15p and (jl6p from the two paths and Lemma lA. 81 we obtain 

2 - 4e < 4|/3|Vl-|/3|2/2 + (l - 2|<5o|')(|a|'(8e + 4|5o| + 4|5i|) + 2|/3|2) + A\a\\\5o\^ - \5i\^) 
< m + 2|/3|2 + 4|5o|' + 8e + 4(|5o| + \5i\) 
<4y7(^ + 6/(e)+8e + 8^, 

where /(e) = ^ (§ + e - y^f + - 5ej . Therefore, we have 1 - iy/e - 6e < 2y7(e) + 3/(e). The 
left-hand side is monotone decreasing on e while the right-hand side is monotone increasing on e. 
By checking e satisfying the inequality, we obtain e > 0.017. 
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A. 4 Proof of Theorem 14.11 

Here is the formal description of XQC. 



Protocol XQC: Input |^/^) at si, and 6 at S2; Output pl^^ at ti, and Out^ at t2. 
Step 1. (Qi, Q2) = UC{\iP)) at si, and Q3 = Q4 = \b). 
Step 2. Q5 = X''(Q2) at sq. 
Steps. (Q6,Q7) = C/C(Q5)atii. 

Step 4 (Decoding at node ti and t2). plut = X^Qj), and Out^ = if M[B^](Qi) = M[Bz]{Q6), 
1 otherwise. 



To average the fidehties at both sinks, implement XQC with probability 3/4 and replace Step 
1 by the following operation with probability 1/4: send a bit r uniformly at random from si to Sq 
and t2. 

Now we show that XQC achieves fidelity 13/18 and 11/18 at ti and t2, respectively. (The 
analysis of fidelity 2/3 by averaging is omitted since it is rather simpler.) First, we show that the 
fidelity at ti is 13/18. For this purpose, consider the path from si to ti in Fig. [6l Note that along 
the path, the operations at nodes si and to are 2/3-shrinking, and the operation at sq is X^. They 
are commutative, and hence the composite operation on the system Q2 along this path can be 
considered as a 4/9-shrinking map followed by X^. Since X^ is applied at ti again, the final state 
at h is llV'XV'l + i • i Hence, the fidelity is F{pl^t, {ip)) = 13/18. 

Second, we show that the probability of recovering 6 at node t2 is 11/18. For this purpose, we 
have to consider the path from S2 to t2 in Fig. [6] and the entangled state of Qi Q2- Particularly, 
the cloning at t^, which only operates on the later half of the system, can be regarded as p-shrinking 
map on Q2 in the following sense. 

Lemma A. 9 Let pi2 be a two-qubit state and p'12 be the two-qubit state after applying a p-shrinking 
map on the second qubit o/pi2- Then, 



p'i2 = PP12 + (1 - P) (^Tr2(pi2) <S) 



Proof. Consider the cases of the 1-shrinking and 0-shrinking maps on the second qubit of pi2. 
In those cases, p'12 is mapped to pi2 and (Tr2(pi2) ^5" §), respectively. (For p = 0, this is verified 
from the facts that Tri(p']^2) = i and Tr2(Pi2) = Tr2(pi2) for any pi2.) For < p < 1, it is easy to 
see that p'^2 can be described as a linear combination of the above two cases from the linearity of 
quantum operation. □ 

Now, it is easy to compute the success probability of recovering b at node t2 using the above 
lemma for p = 2/3. Let pi2 and p'12 be the two-qubit state on Qi (gi Q2 and on Qi0Qq, respectively. 
We can check that (00|pi2|00) + (ll|pi2|ll) = |, and (OO|Tr2(pi2)0^|OO) + (ll|Tr2(pi2)®||ll) = ^ 
Note that when 6 = 0, pi2 does not change at sq. By Lemma lA.91 the probability of recovering 
6 = at node t2 is 

/ , , , V / , , , V 2 2 11 11 

(oo|p;2ioo) + (ii|p;2iii) = 3- 3 + 3- 2 = T^- 

On the other hand when b = 1, (/ X) is applied to pi2 at sq and therefore the probability of 
error, i.e., that of obtaining 6 = at node t2 is 

(oo|(/®x)p;2(/0X)|oo) + (ii|(/0X)p;2(/®x)|ii) = (oi|p;2|oi) + (io|p;2|io) = ^-^ = y^ 
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since I (g) X is commutative with the p-shrinking map on the second qubit. Thus we obtain the 
fideUty 11/18 at t2- 



A. 5 Proof of Theorem 15.11 

First, we recall the quantum random access (QRA) coding by Ambainis et al. [4j. An (n,m,p)- 
QRA coding is a function that maps n-bit strings x G {0, 1}" to m-qubit states px satisfying the 
following: For every i G {1, 2, . . . , n} there exists a POVM = {E^, El} such that Tr(ii^* .p^.) > p 
for all X G {0, 1}"", where Xj is the i-th bit of x. If the m-qubit states are classical, the coding is 
called an {n,m,p)-classical random access coding. In [3J, an (2, 1,0.85)-QRA coding is given by the 
following protocol. 

Let |(/j(00)) = cos(7r/8)|0)+sin(7r/8)|l), |v3(10)) = cos(37r/8)|0)+sin(37r/8)|l), = 
cos(57r/8)|0) +sin(57r/8)|l), and |(^(01)) = cos(77r/8)|0) + sin(77r/8)|l) be the one-qubit 
state used when the source x G {0, 1}^ is respectively 00, 10, 11, and 01. The first bit 
of X is obtained by measuring in the basis S^, while the second one by measuring in 
the basis Bx- 

In fact, the success probability of the above protocol is cos^(7r/8) ~ 0.85. On the contrary, it was 
also shown that any (2, l,p)-classical random access coding should satisfy p < 1/2. 

A map that transforms an arbitrary equatorial state (i.e., the one-qubit state whose amplitudes 
are real) p\il)){ip\ + {l—p)^ is called a p-shrinking map on equatorial qubits. The following 

lemma is verified from the transformation of the phase-covariant cloning machine [8l[Tl]. (The term 
"the phase-covariant copy" is defined similarly as the universal copy.) Fortunately, for our purpose 
the detail of the cloning machine except the fact that it is a l/\/2-shrinking map is not needed. 

Lemma A. 10 The phase-covariant copy is 1 / \/2-shrinking map on equatorial qubits. 

Finally we introduce the 2D measurement. This measurement is defined by the POVM 
{^\(p{ziZ2)) I Z1Z2 G {0, 1}^}, denoted by MM2. Its intuition is to do the two projective measure- 
ments in the bases {|(/9(00)), |(/9(11))} and {|(/9(01)), |(/7(10))} with probability 1/2 for each. Notice 
that we estimate the QRA coding state from 82 correctly if we choose the right one of the two 
bases. 

The detailed description of X2C2C is as follows. The term (Q, Q') = PC{Q") means that Q 
and Q' are the two copies output by the phase-covariant quantum cloning machine when Q" is 
given as the input. 

Protocol X2C2C: Input 3:1X2 at si, yiy2 at S2] Output Out^ at ti, Out^ at t2- 
Step 1. Qi = \lp{xiX2)), Q2 = \<f{xiX2)), Q3 = W{yiy2)), and Q4 = \Lp{yiy2)). 
Step 2. Q5 = GR{Q2,MM2{Q^)) at sq. 
Step 3. (Q6,Q7) = PC(Q5) at to- 

Step 4 (Decoding the j-th bit at ti and t2). Out^ = M[B:,]{Q^) ® M[B:,]{Qj) if j = 1, and 
M[Bx]{Qa) © M[Bx]{Q7) if i = 2. Out2 = M[B,]{Qi) © M[B,]{Q(,) if j = 1, and M[5,](Qi) © 
M[Bx\{Q&) if j = 2. 

Here, we analyze the success probability of X2C2C. By the definition of MM2 the following 
lemma is immediate. 

Lemma A. 11 Given a QRA coding state \ip{yiy2)), the probability that Z1Z2 is obtained by MM2 
is 1/2 if Z1Z2 = yiy2, 1/4 if ziZ2 = yiy2 or yiy2, and if ziZ2 = yiy2- Here, b denotes the negation 
of a bit b. 
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Figure 11: (3, 1,0.79)-QRA coding in the Bloch sphere representation 



For simphcity, let us assume that yiy2 = 00 (the analysis of the other cases are similar). By Lemma 
lAin the state of Q2 ® Qs after MM2 is 

|(^(xiX2))MxiX2)| ® Q|00)(00| + ^(|10)(10| + |01)(01|)) . 

Note that if yiy2 is obtained by MM2, the state \ip{xiX2)) from si is transformed into \(p{xi © 
yi,X2 © ^2)) by GR. Thus, the state of Q5 is 

^\if{xiX2)){(p{xiX2)\ + ^{\(f{xiX2)){(f{xiX2)\ + \(p{xiX2)) {<fixiX2)\) 

By Lemma Fa. 101 the state of Qq (or Q7) is 

\(p{xiX2)){^pixiX2)\ + --^{\(p{xiX2)){^pixiX2)\ + \(p{xiX2)) {^pixiX2)\) + ( 1 \=] ^. 



2^/2 4^/2 V \/2y 2 

Now we check the success probability of decoding the first bit of yiy2 = 00, i.e., at t2 (the other 
cases are similarly checked). As seen from the state of Qq, the success probability of decoding the 
first bit of X1X2 © yiy2, i-e., xi is 

1 2^ 1/2^ ■ 2 \ ^ f ^ 1 
cos — I j=[cos — h sm — j H — 1 — 



2V2 8 4^2 8 8' 2 V ^2 

which is 5 /8. On the contrary, the success probability of decoding the first bit xi from the state of Q 
is cos^ I . Thus, the success probability of decoding the first bit of yiy2 at t2 is cos^ ^ • | +sin^ f ' 1 ~ 
1/2 + a/2/16 as claimed. 



A. 6 Proof of Theorem 15.21 

For the proof of Theorem 15.21 we need the following two primitives. 

3D Measurement (MM3). The 3D measurement, denoted by MM3, is defined by the POVM 
described by {^\ip{ziZ2Z3)){ip{ziZ2Z3)\ \ ziZ2Z^ e {0,1}'^}, where \(p{ziZ2Z3)) is the (3, 1, 0.79)-QRA 
coding state of Z1Z2Z3 (Fig. [TT]) . 

Approximated Group Operation (AG). Before its definition, we introduce the operation 
Inv, which maps a pure state \ip) = a|0)+6|l) to its "opposite" state 6*|0) — a* |1) in the Bloch sphere 
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(see e.g., [IOl[T3]). Formally, it is defined as follows: For any mixed state p = ( ^ ^ Invp 



w X 

^ ^ ^ u ^ ) ' ^'^^ °^ ^ T^pVF'^ (ly e {/, X, y, Z, Inv, InvX, Invy, InvZ}) is 

an abelian group. Because Inv is not a TP-CP map, we introduce its approximation Inv', which 
maps p to Inv'p = |lnvp + | • |- We can check that Inv' is a TP-CP map. The approximated 
group operation under a three-bit string rir2r3, denoted by AG{p,rir2r^)^ is a transformation 
defined by ^G(p,000) = p, AG(p,011) = Zp, AG(p, 101) = Xp, ^G(p, 110) = Yp and, for any 
nrsrg G {001,010,100,111}, AG(p,rir2r3) = Inv'^G(p, fifsfs). 
The description of the protocol X3C3C is as follows. 

Protocol X3C3C: Input xiX2X'i at si, yiy2y3 at S2; Output Out^ at ti, Out^ at t2- 

Step 1. Qi = |v?(xiX2a;3)), Q2 = \(p{xiX2Xs)) , Q3 = |v?(yiy2y3)>, and Q4 = |'/'(yiy2y3))- 
Step 2. Q5 = AG(Q2,MM3(Q3)) at sq- 
Step 3. (Qe, Q7) = UCiQ^) at to- 

Step 4 (Decoding the j-th bit at ti and t2)- Out^ = M[B^]{Q4) © M[52](Q7) if j = 1, 
M[5,](Q4) © M[B^]{Q-r) if j = 2, and M[By]{Q4) © M[5^](Q7) if J = 3. Out^ = M[B,]{Qi) © 
M[S,](Q6) if J = 1, M[B,]{Qi) © M[SJ(Q6) if J = 2, and M[5^](Qi) © M[By]{Q6) if j = 3. 

Now, we analyze X3C3C, which is similar to X2C2C. By definition of POVM MM3, we can 
easily check the following lemma. 

Lemma A. 12 Given a QRA coding state \fiy1y2y3)), the probability that Z1Z2Z3 is obtained by 
MM3 is 

1/4 if Z1Z2Z3 = yiy2y3, 
1/6 if Z1Z2Z3 = yiy2y3, yimys, ymm, 
1/12 if Z1Z2Z3 = yiy2y3, ymm, yimm, 
if Z1Z2Z3 = yimm 

Henceforth, for simplicity of descriptions we only consider the case yiy2y3 = 000. By Lemma [A.12t 
the state of Q2 © Q3 after MM3 is 

\ip{xiX2Xs)){^{xiX2X3)\ © ( 7|000)(000| + ^(|100)(100| + |010)(010| 

\4 b 

+|001)(001|) + ^(|110)(110| + |101)(101| + |011)(011|) 
Noting that Inv' {\ip{ziZ2Z3)) {(p{ziZ2Z3)\) = ^\ip{ziZ2Z3)) {(p{ziZ2Z3)\ + § • ^, the state of Q5 is 

^\ipixiX2X3)){ip{xiX2X3)\ 

+ ■^{\ip{xiX2X3)){ip{xiX2X3)\ + \ip{xiX2X3)) {ip{xiX2X3)\ + \ip{xiX2X3)) {ip{xiX2X3)\) 
lo 

I _ _ _ _ _ _ _ _ _ _ 2 11 

+ T7;{\^{xiX2X3)){ip{xiX2Xs)\ + \ip{xiX2X3)) {ip{xiX2X3)\ + \ip{xiX2X3)) {ip{xiX2X3)\) + ^ " c " ^ " 

12 3 6 2 
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By Lemma Em the state of Qq (or Q7)) is 





+ —{\ip{xiX2X3)){ip{xiX2X3)\ + \ip{xiX2X3)) {ip{xiX2X3)\ + \ip{xiX2X3)) {ip{xiX2X3)\) 

1 5 / 

+ Tj(l'/'(^1^2X3))(93(Sl^2a;3)| + \ip{xiX2X3)){ip{xiX2X3)\ + |V?(X1X2X3))((/?(X1X2S3)|) + - • -, 

where the last term is obtained by adding ^ ■ j ■ ^, i'l^'^-^, 3"t^"3-|, and | ■ 5 ■ 3 • | . Now 
we check the success probabihty of decoding the first bit of yiy2y3 = 000, i.e., 0. (The other cases 
are similarly checked.) As seen from the state of Qq, the success probability of decoding the first 
bit of X1X2X3 © 2/12/22/3, i-e., xi is 

On the contrary, the success probability of decoding the first bit xi from the state of Qi is 1/2 + 
\/3/6. Thus, the success probability of decoding the first bit of 2/12/22/3 at sink t2 is (l/2+\/3/6)(l/2+ 
2^/k/81) + (1/2 - V3/6)(l/2 - 2V3/81) = 1/2 + 2/81 as desired. 
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